1. Field of Invention
The present invention relates to wireless networking, and more particularly, to a method and system for enabling self-managed network access using localized access management.
2. Description of Related Art
A Wireless Local Area Network (WLAN) is generally implemented to provide local connectivity between a wired network and a mobile computing device. In a typical wireless network, all of the computing devices within the network broadcast their information to one another using radio frequency (RF) communications. WLANs are based on the Institute of Electrical and Electronic Engineers (IEEE) 802.11 standard, which designates a wireless-Ethernet specification using a variety of modulation techniques at frequencies generally in the 2.4 gigahertz (GHz) and 5 GHz license-free frequency bands.
The IEEE 802.11 standard, the disclosure of which is incorporated herein in its entirety by reference, enables wireless communications with throughput rates up to 54 Mbps. There are 802.11 compatible PC cards that operate in peer-to-peer mode, but 802.11 usually incorporates at least one access point, or edge device. Most access points have an integrated Ethernet controller to connect to an existing wired-Ethernet network. An 802.11 wireless transceiver connects users via the access point to the rest of the LAN. The majority of 802.11 wireless transceivers available are in Personal Computer Memory Card International Association (PCMCIA) card form, particularly for laptop, palmtop, and other portable computers, however 802.11 transceivers can be implemented through an Industry Standard Architecture (ISA) slot or Peripheral Component Interconnect (PCI) slot in a desktop computer, a Universal Serial Bus (USB), or can be fully integrated within a handheld device.
FIG. 1 illustrates a typical conventional 802.11 network 100. Particularly, 802.11 network 100 comprises a number (N) of computing devices 110A-N and an access point 120. Each computing device 110 comprises a 802.11 transceiver (not shown) such as a 802.11 enabled network interface card (NIC) to communicate with the access point via an RF communications link 115. The access point 120 comprises a 802.11 transceiver (not shown) to communicate with a wired network via an RF communications link 125.
“Hot-spots” as 802.11 networks are known in the public space, allow users portable, high-speed access to networks. The number of hot-spots available to consumers is rapidly increasing. Each network is “802.11 compatible” and typically offers its users a variety of connection plans. For example, some connections plans allow unlimited usage, some charge users according to a fixed or variable, e.g., peak verses off-peak, rate, while others may limit a user to a predetermined number of connections. Generally, there is no limit to the number and diversity of billing schemes that so called “hot-spot” operators offer their customer base.
Typically, such usage-based plans require that the customer select a particular usage plan and pay for that plan before being able to freely use the network to the limits afforded by that usage plan. Moreover, authentication information is passed onto a remote server, which accounts for and tracks the user's usage of the network at each time a connection is made to a hot-spot. This is generally burdensome and involves considerable non-revenue producing administrative traffic and hence possibly causes delays to users of the network. As all users are usually tracked from a central site, the infrastructure required to support large numbers of users can be daunting. Furthermore, setting up and modifying particular usage plan parameters for a large number of individuals is often not an easy or efficient task.
Network operators generally prefer to respond to a market as conditions dictate. For example, a usage-based plan that had previously been sold for “10 connections per month at $24.95” might be offered the next day for “15 connections per month at $19.95.” Implementing plan changes in a centralized network billing system is a complex process. For instance, the billing system must not only account for the current usage/billing plans implemented, but must also account for all previous plans that users still have in effect.
Equally important are the needs of enterprise information technology (IT) administrators who prefer to provide different access schemes to specific classes of users on the enterprise network. For example, it might be highly desirable to allow a finance clerk who works a day shift, e.g., 9 AM to 5 PM, Mondays through Friday, to have access to a finance network only during the normal working hours. Attempts to use the network at any other time would be restricted. Microsoft® Windows provides for authentication classes, but is generally limited to a YES/NO basis. For instance, users are entered into a database or directory of users that Windows implements when it authenticates a user, typically a RADIUS (Remote Access Dial-In User Service) server. Typically users are given account names and passwords to identify themselves and placed into workgroups. Individual users can be granted access in a PASS/DENY basis for individual machines or groups of machines. Likewise, groups can be granted permission to individual machines on the network. The permissions are always PASS/DENY, ALLOW/RESTRICT, etc. However, in Windows it is difficult to tie other parameters to a user's permission such as PASS or ALLOW to a FINANCE SERVER during normal working hours, but DENY or RESTRICT on nights and weekends. The tie-in of PASS/DENY along with TIME-OF-DAY is difficult to accomplish. In other words, providing access to individual users and groups of machines based on, for example, the period of the workweek is a daunting, if not impossible, task via Windows.
Of further difficulty for the host of a public 802.11 network is properly facilitating access to foreign customers, i.e., those customers who are foreign to the local network. At the Dallas Fort Worth airport, for instance, a Wayport® network is installed to provide travelers with wireless Internet access. Until recently, only Wayport customers could access this network e.g., a T-Mobile customer could not connect unless the user registered to become also a Wayport customer. Boingo offers a service whereby users can access a Wayport network without necessarily being a customer of Wayport.
Boingo employs a ‘sniffer’ program that listens to the beacon frames and looks for a match in its database of known network configurations. When a match is found, the Boingo software will automatically make the appropriate configuration changes for that network and allow the user to connect. Once a connection is attempted, the user appears to the network as a Boingo customer and the user's credentials are passed onto an authentication server for the network. On recognition of the user's name at the authentication server, access is then granted or denied. If the Boingo customer is not really a customer of the present network, the authentication server forwards the user's credentials to a Boingo authentication server, which performs the necessary authentication service and if valid, passes a ‘grant’ command back to the original network authentication server. One disadvantage with this approach is that the Wayport user may be on a different billing plan than the Boingo customer who is using the same network for the same usage plan. This becomes difficult to manage as the number of users and networks grow.